Build: harden 0.0.1 release pipeline

[newtontech]

Summary

• lock the extension identity to newtontech.openqc at 0.0.1 and use Node 22 with locally pinned @vscode/vsce 3.9.2
• add VSIX archive verification, SHA-256, CycloneDX SBOM, production dependency audit, and strict release guards
• use one verified artifact across build-and-verify, protected Marketplace publication, and final GitHub Release
• retire the duplicate unmaintained core Python package while retaining maintained TypeScript and Python bridge product paths
• exclude secrets, local state, caches, tests, and generated release outputs from the product package

Tests

• make format
• make lint
• make typecheck
• make test
• make check
• 81 Jest suites passed with 1563 tests passed and 2 skipped
• Python bridge suite passed with 36 tests
• production dependency audit found 0 vulnerabilities
• VSIX verified at 586 files and 2.89 MiB
• SHA-256 and CycloneDX 1.5 SBOM generated and verified

Deployment status

The protected marketplace-production environment exists and only accepts tag v0.0.1. VSCE_PAT is not configured, so no tag, Marketplace publication, or GitHub Release has been attempted. Human review is required before merge.

Documentation

README, changelog, Marketplace publishing guide, dependency review, developer guide, FAQ, user action guide, and API docs match the implemented release behavior.

Fixes #236